function hexStringToArray(hexString) {
    // 去除可能的空格或前缀（如 "0x"）
    hexString = hexString.replace(/^0x/, '').replace(/\s/g, '');

    // 检查长度是否为偶数
    if (hexString.length % 2 !== 0) {
        throw new Error("Invalid hex string length");
    }

    // 创建数组
    const array = [];

    // 将每两个字符转换为一个字节
    for (let i = 0; i < hexString.length; i += 2) {
        const byte = hexString.substr(i, 2);
        array.push(parseInt(byte, 16));
    }

    return array;
}
// Interceptor.attach(
//     ObjC.classes['MPCryptoService']['- generateRandom:'].implementation,
//     {
//         onEnter(args) {
//             // console.log(`-[NSConcreteMutableData appendBytes:${args[2]} length:${args[3].toInt32()}]`);
//             // console.log(hexdump(args[2], {length: args[3].toInt32()}))
//
//
//         },
//         onLeave(ret) {
//             let a = new ObjC.Object(ret);
//             // console.log('generateRandom', a)
//             let nsstr = ObjC.classes.NSString;
//             let ocstr = nsstr.stringWithFormat_('1111111111111111');
//             ret.replace(ocstr);
//             // console.log('generateRandom2', new ObjC.Object(ret))
//
//         }
//
//     }
// )

let base = Module.getBaseAddress('MTPotal')
var m = Process.enumerateModules()[0];// enumerate loaded modules and take the first one
// var m = Module.load('win32u.dll'); // or load module by name

Interceptor.attach(Module.getExportByName('libsystem_kernel.dylib', 'getentropy'), {
    onEnter: function(args) {
        console.log('[*] getentropy called');
        console.log('Buffer pointer: ' + args[0]);
        console.log('Length: ' + args[1].toInt32());
        this.buffer = args[0];  // 保存 buffer 地址用于 onLeave
        this.length = args[1].toInt32();  // 保存 length
    },
    onLeave: function(retval) {
        console.log('[*] getentropy returned: ' + retval.toInt32());
        if (this.length === 32){
            this.buffer.writeByteArray([109, 65, 85, 98, 115, 212, 252, 205, 26, 142, 45, 232, 196, 15, 254, 147, 132, 222, 117, 71, 217, 210, 106,
                193, 252, 188, 207, 184, 74, 63, 238, 221])
        }
        if (this.length === 64){
            this.buffer.writeByteArray([54, 208, 131, 174, 42, 17, 167, 137, 57, 220, 78, 219, 150, 75, 216, 141, 39, 17, 189, 108, 144, 40, 51, 6,
                226, 99, 238, 210, 48, 197, 226, 182, 100, 197, 22, 12, 192, 22, 159, 212, 236, 234, 139, 107, 70, 25, 106,
                217, 249, 201, 158, 36, 17, 148, 110, 251, 106, 138, 203, 254, 169, 154, 187, 2])
        }
        if (retval.toInt32() === 0) {  // 如果成功
            console.log('Random data: ' + hexdump(this.buffer, { length: this.length }));
        }
    }
});

Interceptor.attach(Module.getExportByName(null, 'gettimeofday'), {
    onEnter: function(args) {
        // console.log('[*] gettimeofday called');
        // console.log('timeval pointer: ' + args[0]);
        // console.log('timezone pointer: ' + args[1]);
        this.timevalPtr = args[0];  // 保存 timeval 指针
        this.timezonePtr = args[1]; // 保存 timezone 指针
    },
    onLeave: function(retval) {
        // console.log('[*] gettimeofday returned: ' + retval.toInt32());
        this.timevalPtr.writeLong(1741759941)
        this.timevalPtr.add(8).writeLong(0)
        if (retval.toInt32() === 0 && this.timevalPtr != 0) {  // 如果成功且时间指针非空
            var tv_sec = Memory.readLong(this.timevalPtr);
            // 读取秒
            var tv_usec = Memory.readLong(this.timevalPtr.add(8)); // 读取微秒 (假设 64 位系统)
            // console.log('Time: ' + tv_sec + ' seconds, ' + tv_usec + ' microseconds');
        }
        if (this.timezonePtr != 0) {  // 如果时区指针非空
            var tz_minuteswest = Memory.readInt(this.timezonePtr);
            var tz_dsttime = Memory.readInt(this.timezonePtr.add(4));
            // console.log('Timezone: ' + tz_minuteswest + ' minutes west, DST: ' + tz_dsttime);
        }
    }
});


// Interceptor.attach(Module.getExportByName('libSystem.B.dylib', 'mach_absolute_time'), {
//     onEnter: function(args) {
//         // console.log('[*] mach_absolute_time called');
//     },
//     onLeave: function(retval) {
//         // console.log('[*] mach_absolute_time returned: ' + retval.toString());
//         // 将时间转换为可读格式（需要时间基准）
//         retval.replace(1090123063000)
//         // var timebase = Memory.alloc(8); // 分配 mach_timebase_info 结构体空间
//         // var mach_timebase_info = new NativeFunction(
//         //     Module.getExportByName('libSystem.B.dylib', 'mach_timebase_info'),
//         //     'int', ['pointer']
//         // );
//         // mach_timebase_info(timebase);
//         // var numer = Memory.readU32(timebase);
//         // var denom = Memory.readU32(timebase.add(4));
//         // var nanoseconds = (retval.toInt64() * numer) / denom;
//         // console.log('Time in nanoseconds: ' + nanoseconds);
//     }
// });
//

// Interceptor.attach(base.add(0xDDC0E8), {
//     onEnter(args){
//         console.log('DDC0E8', args[0], args[1], args[2])
//         this.a0 = args[0];
//         this.a1 = args[1];
//         console.log('DDC0E8 1.0', this.a0.readPointer(),hexdump(this.a0))
//         console.log('DDC0E8 1.1',this.a1.readPointer(), hexdump(this.a1))
//         console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
//         .map(DebugSymbol.fromAddress).join('\n') + '\n')
//
//     },
//     onLeave(ret){
//         console.log('DDC0E8', ret)
//         console.log('DDC0E8 2.0',this.a0.readPointer(), hexdump(this.a0))
//         console.log('DDC0E8 2.0',this.a1.readPointer(), hexdump(this.a1))
//
//     }
// })


Interceptor.attach(
    ObjC.classes['MPSignatureService']['- trustedSignBySignKey:signApi:content:'].implementation,
    {
        onEnter(args) {
            // console.log(`-[NSConcreteMutableData appendBytes:${args[2]} length:${args[3].toInt32()}]`);
            console.log('trustedSignBySignKey:signApi:content:', Date.now())
            console.log(new ObjC.Object(args[2]))
            console.log(new ObjC.Object(args[3]))
            console.log(new ObjC.Object(args[4]))
            // console.log(hexdump(args[2], {length: args[3].toInt32()}))


        },
        onLeave(ret){
            let a = new ObjC.Object(ret);
            console.log('trustedSignBySignKey', a)
            // let nsstr = ObjC.classes.NSString;
            // let ocstr = nsstr.stringWithFormat_('1111111111111111');
            // ret.replace(ocstr);
            // // console.log('generateRandom2', new ObjC.Object(ret))

        }

    }
)
// Interceptor.attach(ObjC.classes['MPSignatureService']['- signByBlueShieldWithType:signKey:autoCode:content:'].implementation, {
//     onEnter(args){
//         console.log('loadTA', args[2])
//         console.log(`-[MPSignatureService signByBlueShieldWithType:${args[2]} signKey:${new ObjC.Object(args[3])} autoCode:${args[4]} content:${args[5]}]`);
//         console.log('auth', new ObjC.Object(args[4]))
//         console.log('content', new ObjC.Object(args[5]))
//         // console.log('signType', obj['- objectForKey:']('signType'))
//     },
//     onLeave(ret){
//         // console.log('retretretret', new ObjC.Object(ret))
//         //         console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
//         // .map(DebugSymbol.fromAddress).join('\n') + '\n')
//     }
// })
//
Interceptor.attach(base.add(0xE1DEF0), {
    onEnter(args) {
        this.a1 = args[0]
        this.a2 = args[1];
        console.log('sub_E1DEF0', args[0], args[1], args[2], args[3], args[4], args[5]);
        // if (this.a2.equals(6)){
        //     console.log(hexdump(args[3], {length:args[4].toInt32()}))
        //
        // }

        // console.log(JSON.stringify(this.context))
        // if (this.context.x4.sub(0x100000000).toInt32() > 0){
        //     console.log(hexdump(this.context.x4))
        //

        // }

        var tid = Process.getCurrentThreadId();
        this.tid = tid;
        // Stalker.follow(tid, {
        //     events: {
        //         call: true, // CALL instructions: yes please
        //         ret: false, // RET instructions
        //         exec: false, // all instructions: not recommended as it's
        //         block: false, // block executed: coarse execution trace
        //         compile: false // block compiled: useful for coverage
        //     },
        //     transform: (iterator) => {
        //         let instruction = iterator.next();
        //         const startAddress = instruction.address;
        //         var isAppCode = startAddress.compare(base.add(0xE1DEF0)) >= 0 && startAddress.compare(base.add(0xE1DEF0).add(10000)) === -1;
        //         do {
        //             if (isAppCode) {
        //                 console.log(instruction.address.sub(base), instruction, '|', instruction.regsRead, '|', instruction.regsWritten);
        //             }
        //             iterator.keep();
        //         } while ((instruction = iterator.next()) !== null);
        //
        //     }
        // })


    }, onLeave(ret) {

        if (this.a2.equals(6)){
            console.log('0xE1DEF0 ret', new ObjC.Object(ret));

        }else if (this.a2.equals(5)){
            console.log('0xE1DEF0 ret', hexdump(new ObjC.Object(ret).bytes(), {length:0x40}));

        }

        //         console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
        // .map(DebugSymbol.fromAddress).join('\n') + '\n')
        Stalker.unfollow(this.tid);
        Stalker.garbageCollect();
    }
})


// Interceptor.attach(base.add(0xF1C338), {
//     onEnter(args){
//         console.log('0x100eb1df8',JSON.stringify(this.context))
//         // console.log(new ObjC.Object(this.context.x2));
//     }
// })
// Interceptor.attach(sub_024A641C, {
//     onEnter(args) {
//         this.a1 = args[0]
//         this.a2 = args[1];
//         this.a6 = args[6];
//         this.a7 = args[7];
//         this.a8 = args[8]
//         // console.log('sub_024A641C', args[0], args[1], args[2], args[5])
//         console.log(`sub_024A641C key`,hexdump(args[1], {length: args[2].toInt32()}))
//         console.log(`sub_024A641C secData`,hexdump(args[3],{length: args[4].toInt32()}))
//         console.log('sub_024A641C a6', args[5])
//
//         // var tid = Process.getCurrentThreadId();
//         // this.tid = tid;
//         // Stalker.follow(tid, {
//         //     events: {
//         //         call: true, // CALL instructions: yes please
//         //         ret: false, // RET instructions
//         //         exec: false, // all instructions: not recommended as it's
//         //         block: false, // block executed: coarse execution trace
//         //         compile: false // block compiled: useful for coverage
//         //     },
//         //     transform: (iterator) => {
//         //         let instruction = iterator.next();
//         //         const startAddress = instruction.address;
//         //         var isAppCode = startAddress.compare(base.add(0x024A641C)) >= 0 && startAddress.compare(base.add(0x024A641C).add(10000)) === -1;
//         //         do {
//         //             if (isAppCode) {
//         //                 console.log(instruction.address.sub(base), instruction, '|', instruction.regsRead, '|', instruction.regsWritten);
//         //             }
//         //             iterator.keep();
//         //         } while ((instruction = iterator.next()) !== null);
//         //
//         //     }
//         // })
//     },
//     onLeave(retval) {
//         console.log('sub_024A641C retval', retval)
//         console.log('sub_024A641C key\n', hexdump(this.a6))
//         console.log('sub_024A641C body\n', hexdump(this.a7.readPointer()))
//         console.log('sub_024A641C postKey\n', hexdump(this.a8.readPointer(), {length: 33})) // key
//         console.log(this.a6, this.a6.readPointer())
//         // Stalker.unfollow(this.tid)
//     }
// })
// Interceptor.attach(base.add(0xDD5724), {
//     onEnter(args){
//         console.log('0xDD5724', args[0], args[1], args[2])
//         this.a0 = args[0];
//         this.a1 = args[1];
//         this.a2 = args[2];
//         console.log('0xDD5724 1.0',this.a0.readPointer(), hexdump(this.a2))
//         // console.log('0xDD5724 1.1',this.a1.readPointer(), hexdump(this.a1))
//         // this.a0 = args[0];
//         // this.a1 = args[1];
//         // console.log('DDC0E8 1.0', this.a0.readPointer(),hexdump(this.a0))
//         // console.log('DDC0E8 1.1',this.a1.readPointer(), hexdump(this.a1))
//         // console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
//         // .map(DebugSymbol.fromAddress).join('\n') + '\n')
//
//     },
//     onLeave(ret){
//         console.log('0xDD5724', ret)
//         // console.log('DDC0E8 2.0',this.a0.readPointer(), hexdump(this.a0))
//         // console.log('DDC0E8 2.0',this.a1.readPointer(), hexdump(this.a1))
//
//     }
//
//
// })

// Interceptor.attach(ObjC.classes['DTURLRequestOperation']['- gzipAndEncrypt:'].implementation, {
//     onEnter(args){
//         let body = new ObjC.Object(args[2]);
//         console.log('trustedSignRequest:', hexdump(body.bytes(), {length: body.length()}))
//                 // console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
//         // .map(DebugSymbol.fromAddress).join('\n') + '\n')
//     },
//     onLeave(ret){
//         let body = new ObjC.Object(ret);
//         console.log('trustedSignRequest:', hexdump(body.bytes(), {length: body.length()}))
//     }
// })

// Interceptor.attach(ObjC.classes['MTDeviceFPManage']['+ deviceFPData'].implementation, {
// Interceptor.attach(ObjC.classes['SM4Tool']['+ SM4WithCBCPKCS5Encrypt:keyString:ivSting:'].implementation, {
// // Interceptor.attach(ObjC.classes['DTRpcOperation']['- initWithURL:method:params:headerFields:amrpc:cdn:'].implementation, {
//     onEnter(args){
//         let body = new ObjC.Object(args[2]);
//         console.log('jsonObjectWithString:', body)
//         console.log('jsonObjectWithString:', new ObjC.Object(args[3]))
//         console.log('jsonObjectWithString:', new ObjC.Object(args[4]))
//         //         console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
//         // .map(DebugSymbol.fromAddress).join('\n') + '\n')
//     },
//     onLeave(ret){
//         let body = new ObjC.Object(ret);
//         console.log('v:', body)
//         //                 console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
//         // .map(DebugSymbol.fromAddress).join('\n') + '\n')
//     }
// })

// Interceptor.attach(base.add(0xE074F0), {
//     onEnter(args){
//         console.log('0xE0AC3C',JSON.stringify(this.context))
//         // this.a3 = args[2];
//         console.log(new ObjC.Object(this.context.x0))
//         // console.log(new ObjC.Object(this.context.x1))
//         console.log(new ObjC.Object(this.context.x2))
//     },
//     onLeave(ret){
//         console.log()
//         console.log('0xE0AC3C.ret', ret)
//     }
// })

// Interceptor.attach(ObjC.classes['DTRpcUtils']['+ compressGZip:'].implementation,
// // Interceptor.attach(base.add(0x22AC34C),
//     {
//         onEnter(args){
//             let t =new ObjC.Object(args[2]);
//             console.log('arg3', hexdump(t.bytes(), {length:t.length()}));
//             console.log('0x22AC34C',args[0],args[1], args[2], args[3], args[4], args[5], args[6], args[7], args[8]);
//             // console.log(hexdump(args[0]));
//             console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
//                 .map(DebugSymbol.fromAddress).join('\n') + '\n')
//             // console.log('arg1', hexdump(args[1], {length: args[2].toInt32()}));
//             // console.log('arg2', hexdump(args[3], {length: args[4].toInt32()}));
//
//
//
//         }
//     }
// )

// Interceptor.attach(ObjC.classes['SM4Tool']['+ SM4WithCBCPKCS5Encrypt:keyString:ivSting:'].implementation,
// // Interceptor.attach(base.add(0x22AC34C),
//     {
//         onEnter(args){
//             let t2 =new ObjC.Object(args[2]);
//             let t3 =new ObjC.Object(args[3]);
//             let t4 =new ObjC.Object(args[4]);
//             console.log('SM4Tool', t2, t3, t4)
//             let ttt = t2['- utf8Data']();
//             console.log('222', hexdump(ttt.bytes(), {length:ttt.length()}))
//             // console.log('arg3', hexdump(t.bytes(), {length:t.length()}));
//             // console.log('0x22AC34C',args[0],args[1], args[2], args[3], args[4], args[5], args[6], args[7], args[8]);
//             // console.log(hexdump(args[0]));
//
//             // console.log('arg1', hexdump(args[1], {length: args[2].toInt32()}));
//             // console.log('arg2', hexdump(args[3], {length: args[4].toInt32()}));
//
//
//
//         }
//     }
// )
//
// Interceptor.attach(ObjC.classes['NSData']['- LBXCryptWithOp:algorithm:optionMode:padding:key:iv:error:'].implementation,
// // Interceptor.attach(base.add(0x22AC34C),
//     {
//         onEnter(args){
//             let t2 =new ObjC.Object(args[0]);
//             let t3 =new ObjC.Object(args[6]);
//             let t4 =new ObjC.Object(args[7]);
//             console.log('SM4Tool', t2, t3, t4)
//             console.log('1', hexdump(t2.bytes(), {length:t2.length()}))
//
//             console.log('2', hexdump(t3.bytes(), {length:t3.length()}))
//
//             // let ttt = t2['- utf8Data']();
//             // console.log('222', hexdump(ttt.bytes(), {length:ttt.length()}))
//             // console.log('arg3', hexdump(t.bytes(), {length:t.length()}));
//             // console.log('0x22AC34C',args[0],args[1], args[2], args[3], args[4], args[5], args[6], args[7], args[8]);
//             // console.log(hexdump(args[0]));
//
//             // console.log('arg1', hexdump(args[1], {length: args[2].toInt32()}));
//             // console.log('arg2', hexdump(args[3], {length: args[4].toInt32()}));
//
//
//
//         },
//         onLeave(ret){
//             let r = new ObjC.Object(ret)
//             console.log('LBXCryptWithOp:algorithm:optionMode:padding:key:iv:error:', hexdump(r.bytes(), {length: r.length()}))
//         }
//     }
// )
//
//
// Interceptor.attach(base.add(0x1BA894), {
//     onEnter(args){
//         console.log('1BA894', args[0], args[1],  args[2],args[3], args[4], args[5],args[6],args[7], args[8])
//     },
//     onLeave(ret){
//         console.log('1BA894.ret', ret)
//     }
// })
//
// Interceptor.attach(base.add(0x00028fec), {
//     onEnter(args){
//         console.log('0x00028fec',new ObjC.Object(args[2]))
//     }
// })
//
// Interceptor.attach(base.add(0xE6D598), {
//     onEnter(args){
//         console.log('0xE6D598',JSON.stringify(this.context))
//     }
// })